Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Judge: Americans can be forced to decrypt their laptops

news.cnet.com

Post reply on HN
Print view View original

161–170 of 190 posts

Re: Judge: Americans can be forced to decrypt their laptops

#161

Post by asd344335345 »

o2sd wrote: post #147
rorrr wrote: post #137

Earlier quoted context omitted.

TrueCrypt's deniability was broken in 2008. I'm not sure if they fixed it since then.

>> TrueCrypt's deniability was broken in 2008. Citation? >> I'm not sure if they fixed it since then. Maybe you could find out and post something useful.

"In a paper published in 2008 and focused on the then latest version (v5.1a) and its plausible deniability, a team of security researchers led by Bruce Schneier states that Windows Vista, Microsoft Word, Google Desktop, and others store information on unencrypted disks, which might compromise TrueCrypt's plausible deniability. The study suggested the addition of a hidden operating system functionality; this feature was added in TrueCrypt 6.0. When a hidden operating system is running, TrueCrypt also makes local unencrypted filesystems and non-hidden TrueCrypt volumes read-only to prevent data leaks. The security of TrueCrypt's implementation of this feature was not evaluated because the first version of TrueCrypt with this option had only recently been released."

Re: Judge: Americans can be forced to decrypt their laptops

#162

Post by timdev2 »

jangusa wrote: post #139
evgen wrote: post #129

Earlier quoted context omitted.

No, the point of the 5th is that you cannot be compelled to give testimony against yourself (which is under oath and for which you will go to jail if you perjure yourself.) You are not protected from helping to convict yourself if you leave the evidence of your crimes available to the court. An encrypted drive is being considered as something like an un-crackable safe for which you have the combination; providing the…

Providing the password to a safe that contains incriminating documents actually is testimonial in nature because it requires you to disclose information you have in your mind (see above). As such, any information that the government obtains by compelling you to give them the password cannot be used against you in a criminal trial. The judge in the case being discussed here got it wrong, and his decision will be overt…

But as the article mentioned:

"Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder."

So the state is arguing that they're not demanding the password, only the plaintext.

Still seems fishy, but it's not clear that it's testimonial.

I suppose one could argue that it's more akin to a judge demanding that you produce the corpse the police have so far been unable to locate.

Better still, as someone else said, it's like the police demanding that you translate notes you wrote down in your own made-up-and-known-only-to-you language.

Re: Judge: Americans can be forced to decrypt their laptops

#163

Post by jiggy2011 »

pyre wrote: post #157
CGamesPlay wrote: post #59

Earlier quoted context omitted.

Truecrypt does have an option to disable file time updates on file volumes. Also for ext at least, you can mount with nomtime, noatime, noctime and completely disable file times.

How does preventing the filesystem from writing timestamps solve anything? We're talking about the 'boring partition' having timestamps that suggest that you haven't used it in months (i.e. really old timestamps), when there is probably evidence elsewhere that you have used it (e.g. emails that you've sent since those timestamps).

just write false timestamps to the FS saying it was used more recently?

Re: Judge: Americans can be forced to decrypt their laptops

#164

Post by jiggy2011 »

korny wrote: post #93
gcr wrote: post #6

Earlier quoted context omitted.

The fact that you have truecrypt installed on your start menu is a dead giveaway.

I use truecrypt to encrypt lots of legitimate stuff. All my financial data is on a truecrypt volume on DropBox. And I suspect that folks with something to hide wouldn't find it hard to hide trucrypt itself.

where you going to hide it? In another truecrypt volume?

It would be easier just to only use it via a VM booted from a Linux Live CD.

Re: Judge: Americans can be forced to decrypt their laptops

#165

Post by jiggy2011 »

burgerbrain wrote: post #136
tedunangst wrote: post #131

Earlier quoted context omitted.

How do you propose police execute a search warrant in someone's house? Or should the police never be allowed in your house under any circumstance?

"Or should the police never be allowed in your house under any circumstance?" The only circumstance is with my consent. Unfortunately I cannot prevent physical intrusions. When it comes to security of data however thankfully things have been improving.

Sometimes the police might need to enter someones property or get access to data to stop crime.

Whilst I think that of course people should stand up for civil liberties etc we have to bear in mind if we completely neutered the police your civil liberties aren't worth shit as a criminal can just take them from you as nobody has enough power to gather evidence against them.

You then risk people turning to mob justice with no due process whatsoever.

Re: Judge: Americans can be forced to decrypt their laptops

#166

Post by 3143 »

jrockway wrote: post #116
ComputerGuru wrote: post #94

Earlier quoted context omitted.

If I'm not mistaken, there's no limit on contempt of court. A... stubborn judge could keep you detained until you're no longer in contempt.

I've read that it's tied to a particular grand jury session, which is something like 18 months. Either way, the longest contempt sentence ever was 14 years, which is nothing compared to what you'll get if the government convicts you of laundering money, selling drugs, possessing child porn, or all the other crimes that you might have documented on your computer.

Why would you want that person to be able to avoid going to jail just because he was smart enough to use encryption?

Re: Judge: Americans can be forced to decrypt their laptops

#167

Post by finnw »

dagw wrote: post #158
MengYuanLong wrote: post #151

Earlier quoted context omitted.

I really like this idea but I think it is important to ensure that whatever XXX material you have, the actors are clearly over 18. Lord knows it may make your standing far worse if you have anything pushing the line. So, 30+ year old models in your Safe For Government/get out of jail porn directory.

Also make sure the XXX material is fully paid for and licensed, or they'll no doubt slap pirating charges on you for your porn collection.

That's probably not feasible these days. Commercial porn sites only offer licenses for streaming, not downloading.

Re: Judge: Americans can be forced to decrypt their laptops

#168

Post by Nick_C »

worldimperator wrote: post #148
scottdw2 wrote: post #58

You can be compelled to produce a physical key to a safe. However what if the contents of the safe are paper with text written in an invented language, known only to you? Can you be compelled to translate them for the court? What if they just contained numbers? Could you be forced to explain what the numbers mean? I would conclude that such an action would violate the 5th ammendment. Forcing her to decrypt the hard d…

Maybe I'm wrong, but doesn't entropy in an information source mean there's _more_ information rather than less ?

No, assuming you mean high entropy. (You need a qualifier with "entropy", e.g. high or low.) Roughly, high entropy means disorder, information means order:

http://en.wikipedia.org/wiki/Entropy_(statistical_views) Look at the coin toss example.

Re: Judge: Americans can be forced to decrypt their laptops

#169

Post by hobin »

rdtsc wrote: post #138
nirvana wrote: post #60

I wonder about this: What if the key to the encryption is written on a dozen seemingly random notes on yellow sticky notes in your office full of yellow sticky notes? Or, it is composed of the last letter on each page of a series of innocuous looking documents, such that the government might seize the documents but naturally in the process of doing so, scramble the documents order rendering the password irretrievable…

> the data is impossible to decrypt. In fact that is exactly what defense is saying would be the next argument coming from them. One can claim they forgot the password. The judge might not believe them, so they can just slap contempt of court charges one after another? What the person has actually forgot the password? How can they prove that they forgot something. > Then in court you can testify honestly to exactly h…

> One can claim they forgot the password. The judge might not believe them, so they can just slap contempt of court charges one after another? What the person has actually forgot the password? How can they prove that they forgot something. Shouldn't the court be the one proving stuff? Having to prove you have forgotten your password is like being guilty before being proven innocent.

Obviously, there are many cases where it seems extremely unlikely to us that someone has just forgotten his/her password, but as far as I'm concerned that does not constitute proof. (Otherwise, I think this would be one of those cases where people can get convicted just for being not very smart.)

> Not a bad idea in theory. However if the judge/jury can be convinced that you set up your password retrieving system specifically so that a search would destroy the password, they can still slap obstruction and contempt charges on you. I think that is the problem -- inability to convince the judge that you can't decrypt vs that you don't want to.... Except that one could argue that you have been using this system for a long time (as you have) in case people who were not authorized to use your computer stole it. They can't prove you've set up this system specifically to disrupt their case.

This doesn't solve the problem when law enforcement simply asks you to hand over your computer, of course, but when they come stomping through the door and take away your stuff, you can say "neener-neener, you should've just asked." (I suggest not using those exact words.)

Re: Judge: Americans can be forced to decrypt their laptops

#170

Post by scottdw2 »

tedunangst wrote: post #130
scottdw2 wrote: post #58

You can be compelled to produce a physical key to a safe. However what if the contents of the safe are paper with text written in an invented language, known only to you? Can you be compelled to translate them for the court? What if they just contained numbers? Could you be forced to explain what the numbers mean? I would conclude that such an action would violate the 5th ammendment. Forcing her to decrypt the hard d…

The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. uh, the bits of a compressed file also exhibit a high level of entropy. Are compressed files not information either?

A compressed file has a bit pattern that clearly identifies it as compressed. It has statistical structure. Either way, a court couldn't compel her to uncompress a file either, as it would still constitute testimony.
Post reply on HN